Nagios Support Forum

Support for Nagios products and services
https://support.nagios.com/forum/

Pie chart not working

https://support.nagios.com/forum/viewtopic.php?t=62499

Page 2 of 2

Re: Pie chart not working

Posted: Fri May 14, 2021 3:01 am
by shifty
Here is the output of

Code: Select all

tail -Fn0 /var/log/apache2/error.log /var/log/apache2/other_vhosts_access.log /var/log/elasticsearch/*

Code: Select all

127.0.0.1:80 x.x.x.xx - - [14/May/2021:09:55:34 +0200] "GET /nagioslogserver/api/backend/logstash-2021.05.14,logstash-2021.05.13/_mapping/field/severity_label HTTP/1.1" 200 1531 "http://xxx.xxx.xxx.xxx/nagio/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0"
127.0.0.1:80 x.x.x.xx - - [14/May/2021:09:55:38 +0200] "GET /nagioslogserver/app/panels/terms/module.php?ver=2.0.0-3.1.1-nagios-5 HTTP/1.1" 200 1333 "http://xxx.xxx.xxx.xxx/nagioslogserver/dashboard" "Mozill x64; rv:88.0) Gecko/20100101 Firefox/88.0"

==> /var/log/elasticsearch/098e8e98-3ec3-4452-874b-9c6952b2c244.log <==
[2021-05-14 09:55:38,311][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][0], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][0]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][2], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][2]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][4], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][4]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][3], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][3]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][1], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][1]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][2], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][2]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,311][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][1], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][1]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,311][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][0], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][0]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][4], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][4]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,314][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] All shards failed for phase: [query]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][4]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][3], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][3]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more

==> /var/log/apache2/other_vhosts_access.log <==
127.0.0.1:80 x.x.x.xx - - [14/May/2021:09:55:38 +0200] "POST /nagioslogserver/api/backend/logstash-2021.05.14,logstash-2021.05.13/_search HTTP/1.1" 200 355 "http://xxx.xxx.xxx.xxx/nagioslogserver/dashboard"  Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0"

Re: Pie chart not working

Posted: Fri May 14, 2021 3:56 pm
by ssax
For whatever reason I'm unable to replicate it through the web interface but I can replicate it if I run this command:

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label"}}}}'
I assume that also fails on yours?

This seems to work, does it on yours?

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label.raw"}}}}'
EDITED: Had a mistake in the second one.

Re: Pie chart not working

Posted: Sat May 15, 2021 6:14 am
by shifty
The first command output:

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label"}}}}'

Code: Select all

{
"error" : "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][0]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on                               severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][1]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden                               on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][2]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbi                              dden on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label];}{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][3]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][4]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }]",
"status" : 500
}
The second output:

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label.raw"}}}}'

Code: Select all

{
  "took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 290586,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "the_test" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [ {
        "key" : "Informational",
        "doc_count" : 86658
      }, {
        "key" : "Notice",
        "doc_count" : 24952
      }, {
        "key" : "Error",
        "doc_count" : 240
      }, {
        "key" : "Warning",
        "doc_count" : 224
      }, {
        "key" : "Debug",
        "doc_count" : 16
      } ]
    }
  }
}

Re: Pie chart not working

Posted: Tue May 18, 2021 10:48 am
by gsmith
Hi,

That matches what I am seeing. I need to do some research....

Will let you know what I find.

Thanks

Re: Pie chart not working

Posted: Wed May 19, 2021 2:31 pm
by gsmith
Hey Shifty,

I was able to select 'host' and 'host.raw' from the fields drop-down menu.
Image11.jpg
Are you able to do the same?

If not please export your dashboard for me and give me the steps you are using
to create the pie chart.

Thanks

Re: Pie chart not working

Posted: Thu May 20, 2021 4:56 am
by shifty
Hi gsmith,

no im note able to select host or host.raw from the drop-down menu.

Here are the steps for creating the pie chart:

1:
Select "empty dashboard"
1.PNG
2:
Creating the Dashboard
2.PNG
3:
Creating the pie chart
3.PNG
4:
No suggestions are shown except for _type. I wrote host in myself. The Pie Chart doesnt change.
4.PNG
5.PNG

Re: Pie chart not working

Posted: Thu May 20, 2021 5:04 am
by shifty
5:
I changed "host" to "host.raw" (host.raw also not suggest) but the pie chart changend:
6.PNG
7.PNG
These are all the steps that I have taken. :)

Re: Pie chart not working

Posted: Thu May 20, 2021 2:03 pm
by gsmith
Hey there,

It's funny, but when I get my field list it shows xxx.raw as available for text fields:
shifty.jpg
I went ahead and created the dashboard with two pie charts, one using severity_label and one using severity_label.raw and they are identical:
shifty1.jpg
So it seems like something is different between yours and my installs.
I am running 2.1.8.

I exported my dashboard (shifty-1621537068546.txt) so please load it and see what happens.
You'll need to rename it first: shifty-1621537068546.txt ---> shifty-1621537068546.json

Thanks

Re: Pie chart not working

Posted: Thu May 20, 2021 2:23 pm
by shifty
Hey gsmith,

thank you for your help! So i imported your dashboard and thats what happened :D
piechart1.png

Re: Pie chart not working

Posted: Thu May 20, 2021 3:00 pm
by gsmith
Awesome!

I am locking this thread....so I can get back to working on your Cisco ASA Dashboard issue :lol:
All times are UTC-05:00
Page 2 of 2

Powered by phpBB® Forum Software © phpBB Limited